[Maxstar]

MD5 : ed6cec1486bd9af8a567604112f786bf
Result: 27 /43 (62.8%)
http://www.virustotal.com/file-scan/rep ... 1313512635

[EP_X0FF]

http://www.virustotal.com/file-scan/rep ... 1315466419

FUD 0/ 44 (0.0%)

Even including ByteHero false positives generator.

[EP_X0FF]

BitDefender posted about LockEmAll.

Cyber-Extortion Scam Issues False Child Porn Accusations

nothing really interesting or new, aside from this they forget (or they don't know) that this ransom distributes through tizer networks and exploits from blackhole, not only from fake porn sites.
BTW it's about 1.5 year of this blocker itw (if we'll sum lifetime of all two versions).

[rough_spear]

Hi,
Fraud software.Same malware but with difference in file size and md5.

Weblink - hxxp://1.fov8imd.ru/w.php?f=589&e=2
file size - 30 KB
MD5 : e27e9c1b6c22b334e4eb683765c5969c
SHA1 : dd7a3c1666536f52227a29989da48359ddccf990
SHA256: 2b9219fc303aa95f22ffb9082c61c3a019958162a7555e794253b246b1bb2dd0
ssdeep: 768:A9XZN75ov/6kkPq+rSvpODvFULMObh0lde+fbH:oXXyX6RXr6pODvFsMOGdzfL

VT link - http://www.virustotal.com/file-scan/rep ... 1317917244

Weblink - hxxp://1.fov8imd.ru/w.php?f=591&e=2
File size - 31 KB
MD5 : 47d0dfa2460fec996ee394363c7b66ea
SHA1 : 4e18050b6f4723e327dedd3ed751d79a6230844f
SHA256: b8f19e0e5282c6250e51a3c42d0630106cc0604855aec6c031ab16ba85d41b47
ssdeep: 768:wztygB5dqzg4fSmhH5HNxOxvMxBHngXSW:erdmjFrDNh

VT Link - http://www.virustotal.com/file-scan/rep ... 1317915626

Regards,


rough_spear. ;)

[EP_X0FF]

This is trojan ransom lockemall and these links are come from Blackhole. Wrong thread.

Posts moved.

[EP_X0FF]

FUD

http://www.virustotal.com/file-scan/rep ... 1318921886
0 /43 (0.0%)

unpacked and decrypted

http://www.virustotal.com/file-scan/rep ... 1318932747
22/ 43 (51.2%)

[EP_X0FF]

Blackhole host at 89.208.141.171 down two days ago, new Blackhole location at 79.137.226.93

Currently it's vjl3dvj.ru domain + few reserved for future use

Blackhole link format

http://domainname/random_script_name.php?f=ID

name for script updates few times per day, as well as ransoms they deliver (repacks). Currently starting ID for looking up > 700 and script name is s.php

[EP_X0FF]

FUD

http://www.virustotal.com/file-scan/rep ... 1322133593
0 /43 (0.0%)


decrypted
http://www.virustotal.com/file-scan/rep ... 1322134125

[Xylitol]

memories...
http://www.virustotal.com/file/0d64ca11 ... /analysis/
http://www.virustotal.com/file/22bfc85b ... /analysis/
http://www.virustotal.com/file/1f4badff ... /analysis/